From: tsc@... [mailto:tsc@...]
On Behalf Of Vratko Polak -X (vrpolak - PANTHEON TECHNOLOGIES at Cisco) via Lists.Fd.Io
Sent: Thursday 10 October 2019 17:24
To: Maciek Konstantynowicz (mkonstan) <mkonstan@...>; tsc@...; Ed Warnicke (eaw) <eaw@...>; Kinsella, Ray <ray.kinsella@...>
Subject: Re: [tsc] Scapy licensing issue in FD.io projects [Was: TRex distribution and licensing of external libraries]
Adding some technical details with quick links.
Scapy license  is GLP, not LGPL.
In python, using "import" statement amounts to linking,
which creates  a combined program, instead of
a mere aggregation of different programs.
FD.io projects apply Apache 2.0 license,
globally to the whole repository in case of
TRex , VPP  and CSIT .
The scapy code is imported, and the internal data structures
are used by TRex , VPP  and CSIT python code
( indirectly via TRex for performance tests,
 directly for functional tests).
Additionally, VPP even patches  the scapy code,
so it uses a modified code.
The product of VPP is packaged mostly as binary
(source code is in C), and the packaged Python code
is not related to scapy as far as I know.
But VPP verify jobs are executing tests,
which run the code containing (modified) scapy parts
and original VPP python parts linked together,
which is not allowed by GLP2 (as far as I understand).
Similarly, CSIT jobs are running performance and functional tests
with python parts linking together incompatible  licenses.
From: Maciek Konstantynowicz (mkonstan) <mkonstan@...>
Sent: Thursday, October 10, 2019 5:47 PM
To: tsc@...; Ed Warnicke (eaw) <eaw@...>; Kinsella, Ray <ray.kinsella@...>
Cc: Miroslav Los -X (mirlos - PANTHEON TECHNOLOGIES at Cisco) <mirlos@...>; Hanoch Haim (hhaim) <hhaim@...>; Vratko Polak -X (vrpolak - PANTHEON TECHNOLOGIES at Cisco)
Subject: Re: Scapy licensing issue in FD.io projects [Was: TRex distribution and licensing of external libraries]
Resending from Cisco email account as it’s back and cleared for sending emails to tsc mailer.
Adding Miroslav, Hanoh and Vratko who has been also involved here (Miroslav brought up the issue).
Per our discussion on
FD.io TSC call few mins ago, pls advise on the next steps.
Specifically, how to articulate this case in a crisp and succinct manner for LF(N) legal advisor?
On 10 Oct 2019, at 16:15, Maciek Konstantynowicz <mackonstan@...> wrote:
Correcting the email subject to make it clear it’s related to Scapy licensing agenda topic for today’s FD.io TSC meeting.
On 10 Oct 2019, at 16:12, Maciek Konstantynowicz <mackonstan@...> wrote:
Hi, Here is the background to Scapy licensing agenda topic for today’s
FD.io TSC meeting.
"Miroslav Los -X (mirlos - PANTHEON TECHNOLOGIES at Cisco)" <mirlos@...>
Subject: TRex distribution and licensing of external libraries
26 September 2019 at 15:02:36 BST
"Vratko Polak -X (vrpolak - PANTHEON TECHNOLOGIES at Cisco)" <vrpolak@...>, "Maciek Konstantynowicz (mkonstan)" <mkonstan@...>
I’ve been looking at the dependencies for TRex’s client library, in order to find if it could be distributed independent of the complete trex-core distribution.
I have noticed that the external_lib contains code from several other projects, and may or may not have been modified.
It is reportedly the case for at least pyzmq-ctypes and scapy. Pyzmq-ctypes, apparently abandoned by its original authors, is licensed under GNU LGPL.
Whereas scapy is GPLv2 – in the 2.3.1 version included, this was indicated in the setup.py file of the original release sources on github; the authors added an explicit LICENSE file with GPLv2 for the next version. Nonetheless,
TRex would not have any license other than the GPLv2 which would let it distribute scapy 2.3.1.
I do not see the licensing terms for either of those packages indicated in the distribution, or repository. Nor do I believe the Apache 2.0 license of TRex can be applied to that code.
And most importantly, any code that imports those modules, as it may be a derived work. I’ve only seen scapy used by code under the scripts directory. I think the licensing of those parts of TRex distribution should be
clarified, or otherwise resolved. Thoughts?